2026-07-20_843aad67e7564f9d42794482057f714a_elex_emotet_floxif_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_843aad67e7564f9d42794482057f714a_elex_emotet_floxif_stop
Size 582KB
Sample260720-qaesrsa12p
SHA256 b2a47a569e09afd86d98af31808da597699c153904e8d81eac99f62b1899b0a7
MD5 843aad67e7564f9d42794482057f714a
SHA1 de8320e2d0a75dd63b21761ed1fc37955454ee6d
SHA512 be17a6d92068a61304e257c32bc13a02bc6597800f9f575d0224cf02f68bc9cbd900bd831fa654f6a1149c232513914c3ff583c512e9b9b48bff489701cb37d0
SSDEEP 6144:eiRmpX1V4mCfczi/PEM8MZXisI54Zq5KUhn7XfPreXCenaX7memnTaKaLLuz2Ln9:w4Iz3MZtDZrU5mBjvrEH7/qW
TLSH
T129C4F982725A4FF4EEBBC33750492D1F15027DAD911254BA6FCEBA298DF9201132E736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-20_843aad67e7564f9d42794482057f714a_elex_emotet_floxif_stop

File Explorer

2026-07-20_843aad67e7564f9d42794482057f714a_elex_emotet_floxif_stop

.exe 582KB

2026-07-20_843aad67e7564f9d42794482057f714a_elex_emotet_floxif_stop

IMPHASH d214be6c6a14f864fc014134a04d5aff
SHA256 b2a47a569e09afd86d98af31808da597699c153904e8d81eac99f62b1899b0a7
MD5 843aad67e7564f9d42794482057f714a
SHA1 de8320e2d0a75dd63b21761ed1fc37955454ee6d
SHA512 be17a6d92068a61304e257c32bc13a02bc6597800f9f575d0224cf02f68bc9cbd900bd831fa654f6a1149c232513914c3ff583c512e9b9b48bff489701cb37d0
SSDEEP 6144:eiRmpX1V4mCfczi/PEM8MZXisI54Zq5KUhn7XfPreXCenaX7memnTaKaLLuz2Ln9:w4Iz3MZtDZrU5mBjvrEH7/qW
TLSH
T129C4F982725A4FF4EEBBC33750492D1F15027DAD911254BA6FCEBA298DF9201132E736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

6a:ad:3c:a5:26:ae:d2:da:2f:83:6d:8d:76:3c:a6:6d:f6:b5:b5:1d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Chains

Jun 18, 2013

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Fuji Xerox Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Solution Service Development Group,O=Fuji Xerox Co.\, Ltd.,L=Yokohama,ST=Kanagawa,C=JP

Serial Number

29:66:2a:74:5c:40:15:70:38:f2:78:9d:69:05:e9:c3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 21, 2012 - Aug 23, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

83640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetErrorMode RtlUnwind HeapAlloc HeapFree HeapReAlloc VirtualAlloc GetCommandLineA GetProcessHeap GetStartupInfoA RaiseException ExitProcess HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree HeapCreate GetStdHandle GetACP IsValidCodePage Sleep FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers ReadFile WritePrivateProfileStringA GetThreadLocale GetOEMCP GetCPInfo InterlockedIncrement TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalFlags InterlockedDecrement GetModuleFileNameW GetCurrentProcessId GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesA GetLocaleInfoA lstrcmpA GlobalAlloc FormatMessageA LocalFree MulDiv GetCurrentThreadId GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom FreeLibrary lstrcmpW SetLastError LoadLibraryA GlobalLock GlobalUnlock GlobalFree FreeResource GetVersionExA GetUserDefaultLCID CreateProcessA WaitForSingleObject GetExitCodeProcess CreateDirectoryA CreateFileA SetFilePointer WriteFile CloseHandle GetModuleFileNameA GetTempPathA GetLocalTime GetPrivateProfileStringA FindFirstFileA FindClose FindResourceA LoadResource LockResource SizeofResource GetFileAttributesA GetModuleHandleA GetProcAddress GetCurrentProcess CompareStringA GetVersion GetLastError WideCharToMultiByte MultiByteToWideChar InterlockedExchange HeapDestroy lstrlenA

user32

LoadCursorA GetSysColorBrush EndPaint BeginPaint ClientToScreen GrayStringA DrawTextExA DrawTextA TabbedTextOutA SetCursor GetMessageA GetCursorPos ValidateRect GetWindowThreadProcessId PostQuitMessage ShowWindow SetWindowTextA IsDialogMessageA SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA ModifyMenuA GetMenuState EnableMenuItem CheckMenuItem RegisterWindowMessageA LoadIconA WinHelpA GetCapture CallNextHookEx GetClassLongA GetClassNameA SetPropA GetPropA RemovePropA GetFocus SetFocus GetWindowTextA GetForegroundWindow GetLastActivePopup GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints GetKeyState IsWindowVisible GetMenu PostMessageA GetSubMenu GetMenuItemID GetMenuItemCount MessageBoxA CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA GetSysColor UpdateWindow SetForegroundWindow EnableWindow SendMessageA AdjustWindowRectEx PtInRect GetDlgCtrlID DefWindowProcA CallWindowProcA SetWindowLongA SetWindowPos UnregisterClassA DestroyMenu SendDlgItemMessageA DispatchMessageA TranslateMessage PeekMessageA EndDialog GetNextDlgTabItem GetParent IsWindowEnabled GetDlgItem GetWindowLongA IsWindow DestroyWindow CreateDialogIndirectParamA GetSystemMetrics SetActiveWindow GetActiveWindow GetDesktopWindow CopyRect GetClientRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow ReleaseDC GetDC SetWindowsHookExA

gdi32

ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx DeleteDC GetStockObject SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible DeleteObject SetMapMode RestoreDC SaveDC GetDeviceCaps CreateBitmap GetObjectA SetBkColor SetTextColor GetClipBox

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegSetValueExA RegCreateKeyExA RegQueryValueA RegEnumKeyA RegDeleteKeyA RegOpenKeyA RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

SHGetSpecialFolderPathA ShellExecuteExA

shlwapi

PathFindFileNameA PathFindExtensionA

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

VariantClear VariantChangeType VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_843aad67e7564f9d42794482057f714a_elex_emotet_floxif_stop

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

generic